Skip to content
HRM Framework 2.0 , home
Start the assessment

Level 2 · Cohorts24 cohorts

Cohorts

The 24 named cohorts of the HRM Taxonomy: two or three signals combined into a population a program counts and acts on.

Easy, Medium or Hard (6 Easy, 5 Medium, 13 Hard). A cohort is Easy when every one of its signals is available from standard connectors, Medium when any signal needs setup and none needs an integration or a survey, and Hard when any signal needs an integration or a survey.

Social engineering

7 cohorts

  • CR-SE-01TargetedEasy

    Clicks simulations while targeted by real phishing

    1. SE-B-01Clicks simulated phishing links
    2. SE-T-01Targeted by real phishing

    Predicts Phishing & social engineering, Credential abuse & account takeover

  • CR-SE-02High-impactMedium

    Real-phish clicker with privileged access

    1. SE-B-04Clicks links in real phishing
    2. IA-A-01Holds admin or privileged roles

    Predicts Credential abuse & account takeover, Ransomware & malware intrusion

  • CR-SE-03CriticalMedium

    Social engineering critical triad

    1. SE-B-01Clicks simulated phishing links
    2. SE-T-01Targeted by real phishing
    3. IA-A-01Holds admin or privileged roles

    Predicts Phishing & social engineering, Credential abuse & account takeover

  • CR-SE-04RiskyEasy

    Silent repeat clicker

    1. SE-B-08Repeat clicker (3+ in 180 days)
    2. SE-B-10Reports simulated phishing

    Predicts Phishing & social engineering

  • CR-SE-05High-impactHard

    Help-desk staff deceived by voice simulations

    1. SE-B-05Deceived by voice simulations
    2. SE-A-03Can reset passwords or MFA for others

    Predicts Credential abuse & account takeover

  • CR-SE-06High-impactHard

    Payment approver fooled by impersonation

    1. SE-B-01Clicks simulated phishing links
    2. SE-A-02Holds payment approval authority

    Predicts BEC & payment fraud

  • CR-SE-07VigilantEasy

    Human sensor

    1. SE-T-01Targeted by real phishing
    2. SE-B-12Reports within one hour of delivery

    Predicts Phishing & social engineering

Identity and access

6 cohorts

  • CR-IA-01TargetedEasy

    Exposed credentials without strong MFA

    1. IA-T-01Credentials leaked in a public breach
    2. IA-B-08Enrolls phishing-resistant MFA

    Predicts Credential abuse & account takeover

  • CR-IA-02High-impactMedium

    Admin who removed MFA

    1. IA-B-01Removes an MFA factor
    2. IA-A-01Holds admin or privileged roles

    Predicts Credential abuse & account takeover, Insider & privilege misuse

  • CR-IA-03High-impactMedium

    Credential sharer with privilege

    1. IA-B-02Shares credentials
    2. IA-A-02Member of privileged security groups

    Predicts Insider & privilege misuse

  • CR-IA-04High-impactHard

    Dormant privilege, unusual login

    1. IA-B-04Signs in from unusual contexts
    2. IA-A-03Privileges unused for 90+ days

    Predicts Insider & privilege misuse

  • CR-IA-05CriticalHard

    Keyholder with standing backup access and reuse

    1. IA-B-06Reuses passwords across systems
    2. IA-A-04Standing access to backup or storage consoles
    3. IA-T-01Credentials leaked in a public breach

    Predicts Ransomware & malware intrusion

  • CR-IA-06CriticalMedium

    Compromised account with privilege

    1. IA-T-07Account flagged compromised by the identity provider
    2. IA-A-01Holds admin or privileged roles

    Predicts Credential abuse & account takeover, Insider & privilege misuse

Data handling

2 cohorts

  • CR-DH-01High-impactHard

    Bulk mover in a notice period

    1. DH-B-01Downloads data in bulk above own baseline
    2. DH-A-02In a notice period or role change

    Predicts Insider & privilege misuse

  • CR-DH-02High-impactHard

    Sensitive sharer with sensitive access

    1. DH-B-03Shares sensitive data externally
    2. DH-A-01Access to sensitive data repositories

    Predicts Data mishandling & error, Insider & privilege misuse

Endpoint and device

3 cohorts

Web, cloud and SaaS

1 cohort

AI use

1 cohort

  • CR-AU-01RiskyEasy

    Shadow AI with sensitive data

    1. AU-B-01Uses unauthorized AI tools
    2. AU-B-02Puts sensitive data in AI prompts

    Predicts Shadow AI & agent misuse

AI agents

2 cohorts

  • CR-AG-02CriticalHard

    Over-scoped agent without logging

    1. AG-A-02Agent holds broad or standing permissions
    2. AG-B-04Agent runs without logging enabled

    Predicts Third-party, OAuth & supply chain, Shadow AI & agent misuse

  • CR-AG-01High-impactHard

    Risky owner of AI agents

    1. SE-B-04Clicks links in real phishing
    2. AG-A-01Owns AI agents or service identities

    Predicts Third-party, OAuth & supply chain, Shadow AI & agent misuse

Security culture

1 cohort

  • CR-SC-01RiskyHard

    Overconfident clicker

    1. SC-B-01Overconfident: self-rated ability exceeds results
    2. SE-B-01Clicks simulated phishing links

    Predicts Phishing & social engineering

Readiness and response

1 cohort

  • CR-RR-01High-impactHard

    Exception holder who clicks

    1. RR-A-01Holds an active policy exception
    2. SE-B-04Clicks links in real phishing

    Predicts Phishing & social engineering, Vulnerability exploitation

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment